CVEs

347,095 total · page 5893 of 6,942

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2012-5000	Blueteck Witze Addon		0.03	—	0.01		Sep 19, 2012	SQL injection vulnerability in jokes/index.php in the Witze addon 0.9 for deV!L'z Clanportal allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.
CVE-2012-4999	MERCURY MR804 Router		0.04	—	0.07		Sep 19, 2012	Mercury MR804 Router 8.0 3.8.1 Build 101220 Rel.53006nB allows remote attackers to cause a denial of service (service hang) via a crafted string in HTTP header fields such as (1) If-Modified-Since, (2) If-None-Match, or (3) If-Unmodified-Since. NOTE: some of these details are…
CVE-2012-4998	Starcms Starcms		0.03	—	0.02		Sep 19, 2012	Cross-site scripting (XSS) vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVE-2012-4997	Anecms Anecms		0.03	—	0.03		Sep 19, 2012	Directory traversal vulnerability in acp/index.php in AneCMS allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter.
CVE-2012-4996	Rivetcode Rivettracker		0.03	—	0.01		Sep 19, 2012	Multiple SQL injection vulnerabilities in RivetTracker 1.03 and earlier allow remote attackers to execute arbitrary SQL commands via the hash parameter to (1) dltorrent.php or (2) torrent_functions.php.
CVE-2012-4995	Limesurvey Limesurvey		0.00	—	0.01		Sep 19, 2012	Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web script or HTML via the full_name parameter in a moduser action to admin/admin.php. NOTE: some of these details are…
CVE-2012-4994	Limesurvey Limesurvey		0.00	—	0.01		Sep 19, 2012	SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a browse action. NOTE: some of these details are obtained from third party information.
CVE-2012-4993	Rivetcode Rivettracker		0.03	—	0.02		Sep 19, 2012	torrent_functions.php in RivetTracker 1.03 and earlier does not properly restrict access, which allows remote attackers to have an unspecified impact.
CVE-2012-4992	Flashfxp Flashfxp		0.04	—	0.18		Sep 19, 2012	Multiple buffer overflows in FlashFXP.exe in FlashFXP 4.2 allow remote authenticated users to execute arbitrary code via a long unicode string to (1) TListbox or (2) TComboBox.
CVE-2012-3373	Apache Wicket		0.00	—	0.03		Sep 19, 2012	Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.
CVE-2012-2991	OsCommerce Online Merchant		0.00	—	0.01		Sep 19, 2012	The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.
CVE-2012-2105	Peter Kovacs Timesheet Next Gen		0.03	—	0.02		Sep 19, 2012	Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
CVE-2012-1653	Drupal Taxonomy Views Integrator		0.00	—	0.01		Sep 19, 2012	Cross-site scripting (XSS) vulnerability in the Taxonomy Views Integrator (TVI) module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, related to "views pages."
CVE-2012-1652	Wimleers Hierarchical Select		0.00	—	0.01		Sep 19, 2012	Cross-site scripting (XSS) vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help…
CVE-2012-1651	Thinkleft Submenu Tree		0.00	—	0.01		Sep 19, 2012	Cross-site scripting (XSS) vulnerability in the Submenu Tree module before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4408	Moodle Moodle		0.00	—	0.01		Sep 19, 2012	course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation.
CVE-2012-4407	Moodle Moodle		0.00	—	0.01		Sep 19, 2012	lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file.
CVE-2012-4403	Moodle Moodle		0.00	—	0.01		Sep 19, 2012	theme/yui_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response.
CVE-2012-4402	Moodle Moodle		0.00	—	0.01		Sep 19, 2012	webservice/lib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly restrict the use of web-service tokens, which allows remote authenticated users to run arbitrary external-service functions via a token intended for only one service.
CVE-2012-4401	Moodle Moodle		0.00	—	0.01		Sep 19, 2012	Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform certain topic changes by leveraging course-editing capabilities.
CVE-2012-4400	Moodle Moodle		0.00	—	0.01		Sep 19, 2012	repository/repository_ajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended upload-size restrictions via a -1 value in the maxbytes field.
CVE-2012-2586	Mailtraq Mailtraq		0.03	—	0.02		Sep 19, 2012	Multiple cross-site scripting (XSS) vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary web script or HTML via an e-mail message subject with (1) a JavaScript alert function used in conjunction with the fromCharCode method or (2) a SCRIPT element;…
CVE-2012-2578	Smartertools Smartermail		0.03	—	0.02		Sep 19, 2012	Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a JavaScript alert function used in conjunction with the fromCharCode method, (2) a SCRIPT element, (3) a…
CVE-2012-0272	Novell Groupwise		0.00	—	0.01		Sep 19, 2012	Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to inject arbitrary web script or HTML via the merge parameter.
CVE-2012-0271	Novell Groupwise		0.04	—	0.17		Sep 19, 2012	Integer overflow in the WebConsole component in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before 8.0.3 HP1 and 2012 before SP1 might allow remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow, as…
CVE-2011-3827	Novell Groupwise		0.00	—	0.04		Sep 19, 2012	The iCalendar component in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted date-time string in a .ics attachment.
CVE-2012-3258	Microfocus Operations Orchestration		0.01	—	0.10		Sep 19, 2012	Unspecified vulnerability in HP Operations Orchestration 9.0 before 9.03 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2012-1660	Nathan Haug Webform		0.00	—	0.01		Sep 18, 2012	Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select (or other)" module is enabled, allow remote authenticated users with the create webform content…
CVE-2012-1659	Drupal Node Recommendation		0.00	—	0.01		Sep 18, 2012	Cross-site scripting (XSS) vulnerability in the Node Recommendation module 6.x-1.x before 6.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1658	Drupal Read More Link		0.00	—	0.01		Sep 18, 2012	Cross-site scripting (XSS) vulnerability in the Read More Link module 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users with the access administration pages permission to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1657	Fourkitchens Block Class		0.00	—	0.02		Sep 18, 2012	Cross-site scripting (XSS) vulnerability in block_class.module in the Block Class module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the class name.
CVE-2012-1656	Wesjones Multisite Search		0.00	—	0.01		Sep 18, 2012	SQL injection vulnerability in the Multisite Search module 6.x-2.2 for Drupal allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the Site table prefix field.
CVE-2012-1655	Sven Decabooter Uc Paydutchgroup \/ Wedeal Payment		0.00	—	0.01		Sep 18, 2012	Unspecified vulnerability in the UC PayDutchGroup / WeDeal payment module 6.x-1.0 for Drupal allows remote authenticated users to obtain account credentials via unknown attack vectors.
CVE-2012-1654	Feed Element Mapper Project Data		0.00	—	0.02		Sep 18, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the Data module 6.x-1.x before 6.x-1.0 and 7.x-1.x before 7.x-1.0-alpha3 for Drupal allow remote authenticated users with the administer data tables permission to inject arbitrary web script or HTML via the title parameter…
CVE-2012-1901	Flexcms Flexcms		0.03	—	0.01		Sep 18, 2012	Multiple cross-site request forgery (CSRF) vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to (1) hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or (2) hijack the authentication of…
CVE-2012-1184	Asterisk Asterisk		0.04	—	0.16		Sep 18, 2012	Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest…
CVE-2012-1183	Asterisk Asterisk		0.00	—	0.04		Sep 18, 2012	Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote…
CVE-2011-4941	Matomo Matomo		0.00	—	0.02		Sep 18, 2012	Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors.
CVE-2012-4425	Gtk Libgio		0.03	—	0.01		Sep 18, 2012	libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the…
CVE-2012-4413	OpenStack Keystone		0.00	—	0.02		Sep 18, 2012	OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
CVE-2012-4405	ICC icclib		0.01	—	0.07		Sep 18, 2012	Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary…
CVE-2012-3547	FreeRADIUS Freeradius		0.00	—	0.06		Sep 18, 2012	Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client…
CVE-2012-3524	Libdbus libdbus		0.03	—	0.05		Sep 18, 2012	libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is…
CVE-2012-3034	Siemens Foundation Wincc		0.00	—	0.02		Sep 18, 2012	WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a username and password via crafted parameters to unspecified methods in ActiveX controls.
CVE-2012-3032	Siemens Foundation Wincc		0.00	—	0.02		Sep 18, 2012	SQL injection vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to execute arbitrary SQL commands via a crafted SOAP message.
CVE-2012-3031	Siemens Foundation Wincc		0.00	—	0.02		Sep 18, 2012	Multiple cross-site scripting (XSS) vulnerabilities in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allow remote attackers to inject arbitrary web script or HTML via a (1) GET parameter, (2) POST parameter, or (3) Referer HTTP…
CVE-2012-3030	Siemens Foundation Wincc		0.00	—	0.03		Sep 18, 2012	WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, stores sensitive information under the web root with insufficient access control, which allows remote attackers to read a (1) log file or (2) configuration file via a direct request.
CVE-2012-3028	Siemens Foundation Wincc		0.00	—	0.01		Sep 18, 2012	Cross-site request forgery (CSRF) vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that modify data or cause a denial of service.
CVE-2012-4969	Microsoft Internet Explorer	Hig	0.74	8.1	0.82	KEV	Sep 18, 2012	Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.
CVE-2012-2994	Cososys Endpoint Protector		0.04	—	0.06		Sep 18, 2012	The CoSoSys Endpoint Protector 4 appliance establishes an EPProot password based entirely on the appliance serial number, which makes it easier for remote attackers to obtain access via a brute-force attack.

CVE-2012-5000Sep 19, 2012
Blueteck
Witze Addon
risk 0.03cvss —epss 0.01
SQL injection vulnerability in jokes/index.php in the Witze addon 0.9 for deV!L'z Clanportal allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.
CVE-2012-4999Sep 19, 2012
MERCURY
MR804 Router
risk 0.04cvss —epss 0.07
Mercury MR804 Router 8.0 3.8.1 Build 101220 Rel.53006nB allows remote attackers to cause a denial of service (service hang) via a crafted string in HTTP header fields such as (1) If-Modified-Since, (2) If-None-Match, or (3) If-Unmodified-Since. NOTE: some of these details are…
CVE-2012-4998Sep 19, 2012
Starcms
Starcms
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVE-2012-4997Sep 19, 2012
Anecms
Anecms
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in acp/index.php in AneCMS allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter.
CVE-2012-4996Sep 19, 2012
Rivetcode
Rivettracker
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in RivetTracker 1.03 and earlier allow remote attackers to execute arbitrary SQL commands via the hash parameter to (1) dltorrent.php or (2) torrent_functions.php.
CVE-2012-4995Sep 19, 2012
Limesurvey
Limesurvey
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web script or HTML via the full_name parameter in a moduser action to admin/admin.php. NOTE: some of these details are…
CVE-2012-4994Sep 19, 2012
Limesurvey
Limesurvey
risk 0.00cvss —epss 0.01
SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a browse action. NOTE: some of these details are obtained from third party information.
CVE-2012-4993Sep 19, 2012
Rivetcode
Rivettracker
risk 0.03cvss —epss 0.02
torrent_functions.php in RivetTracker 1.03 and earlier does not properly restrict access, which allows remote attackers to have an unspecified impact.
CVE-2012-4992Sep 19, 2012
Flashfxp
Flashfxp
risk 0.04cvss —epss 0.18
Multiple buffer overflows in FlashFXP.exe in FlashFXP 4.2 allow remote authenticated users to execute arbitrary code via a long unicode string to (1) TListbox or (2) TComboBox.
CVE-2012-3373Sep 19, 2012
Apache
Wicket
risk 0.00cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.
CVE-2012-2991Sep 19, 2012
OsCommerce
Online Merchant
risk 0.00cvss —epss 0.01
The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.
CVE-2012-2105Sep 19, 2012
Peter Kovacs
Timesheet Next Gen
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
CVE-2012-1653Sep 19, 2012
Drupal
Taxonomy Views Integrator
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Taxonomy Views Integrator (TVI) module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, related to "views pages."
CVE-2012-1652Sep 19, 2012
Wimleers
Hierarchical Select
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help…
CVE-2012-1651Sep 19, 2012
Thinkleft
Submenu Tree
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Submenu Tree module before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4408Sep 19, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation.
CVE-2012-4407Sep 19, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file.
CVE-2012-4403Sep 19, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
theme/yui_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response.
CVE-2012-4402Sep 19, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
webservice/lib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly restrict the use of web-service tokens, which allows remote authenticated users to run arbitrary external-service functions via a token intended for only one service.
CVE-2012-4401Sep 19, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform certain topic changes by leveraging course-editing capabilities.
CVE-2012-4400Sep 19, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
repository/repository_ajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended upload-size restrictions via a -1 value in the maxbytes field.
CVE-2012-2586Sep 19, 2012
Mailtraq
Mailtraq
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary web script or HTML via an e-mail message subject with (1) a JavaScript alert function used in conjunction with the fromCharCode method or (2) a SCRIPT element;…
CVE-2012-2578Sep 19, 2012
Smartertools
Smartermail
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a JavaScript alert function used in conjunction with the fromCharCode method, (2) a SCRIPT element, (3) a…
CVE-2012-0272Sep 19, 2012
Novell
Groupwise
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to inject arbitrary web script or HTML via the merge parameter.
CVE-2012-0271Sep 19, 2012
Novell
Groupwise
risk 0.04cvss —epss 0.17
Integer overflow in the WebConsole component in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before 8.0.3 HP1 and 2012 before SP1 might allow remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow, as…
CVE-2011-3827Sep 19, 2012
Novell
Groupwise
risk 0.00cvss —epss 0.04
The iCalendar component in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted date-time string in a .ics attachment.
CVE-2012-3258Sep 19, 2012
Microfocus
Operations Orchestration
risk 0.01cvss —epss 0.10
Unspecified vulnerability in HP Operations Orchestration 9.0 before 9.03 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2012-1660Sep 18, 2012
Nathan Haug
Webform
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select (or other)" module is enabled, allow remote authenticated users with the create webform content…
CVE-2012-1659Sep 18, 2012
Drupal
Node Recommendation
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Node Recommendation module 6.x-1.x before 6.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1658Sep 18, 2012
Drupal
Read More Link
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Read More Link module 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users with the access administration pages permission to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1657Sep 18, 2012
Fourkitchens
Block Class
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in block_class.module in the Block Class module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the class name.
CVE-2012-1656Sep 18, 2012
Wesjones
Multisite Search
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the Multisite Search module 6.x-2.2 for Drupal allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the Site table prefix field.
CVE-2012-1655Sep 18, 2012
Sven Decabooter
Uc Paydutchgroup \/ Wedeal Payment
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the UC PayDutchGroup / WeDeal payment module 6.x-1.0 for Drupal allows remote authenticated users to obtain account credentials via unknown attack vectors.
CVE-2012-1654Sep 18, 2012
Feed Element Mapper Project
Data
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the Data module 6.x-1.x before 6.x-1.0 and 7.x-1.x before 7.x-1.0-alpha3 for Drupal allow remote authenticated users with the administer data tables permission to inject arbitrary web script or HTML via the title parameter…
CVE-2012-1901Sep 18, 2012
Flexcms
Flexcms
risk 0.03cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to (1) hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or (2) hijack the authentication of…
CVE-2012-1184Sep 18, 2012
Asterisk
Asterisk
risk 0.04cvss —epss 0.16
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest…
CVE-2012-1183Sep 18, 2012
Asterisk
Asterisk
risk 0.00cvss —epss 0.04
Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote…
CVE-2011-4941Sep 18, 2012
Matomo
Matomo
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors.
CVE-2012-4425Sep 18, 2012
Gtk
Libgio
risk 0.03cvss —epss 0.01
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the…
CVE-2012-4413Sep 18, 2012
OpenStack
Keystone
risk 0.00cvss —epss 0.02
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
CVE-2012-4405Sep 18, 2012
ICC
icclib
risk 0.01cvss —epss 0.07
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary…
CVE-2012-3547Sep 18, 2012
FreeRADIUS
Freeradius
risk 0.00cvss —epss 0.06
Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client…
CVE-2012-3524Sep 18, 2012
Libdbus
libdbus
risk 0.03cvss —epss 0.05
libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is…
CVE-2012-3034Sep 18, 2012
Siemens Foundation
Wincc
risk 0.00cvss —epss 0.02
WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a username and password via crafted parameters to unspecified methods in ActiveX controls.
CVE-2012-3032Sep 18, 2012
Siemens Foundation
Wincc
risk 0.00cvss —epss 0.02
SQL injection vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to execute arbitrary SQL commands via a crafted SOAP message.
CVE-2012-3031Sep 18, 2012
Siemens Foundation
Wincc
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allow remote attackers to inject arbitrary web script or HTML via a (1) GET parameter, (2) POST parameter, or (3) Referer HTTP…
CVE-2012-3030Sep 18, 2012
Siemens Foundation
Wincc
risk 0.00cvss —epss 0.03
WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, stores sensitive information under the web root with insufficient access control, which allows remote attackers to read a (1) log file or (2) configuration file via a direct request.
CVE-2012-3028Sep 18, 2012
Siemens Foundation
Wincc
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that modify data or cause a denial of service.
CVE-2012-4969HigKEVSep 18, 2012
Microsoft
Internet Explorer
risk 0.74cvss 8.1epss 0.82
Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.
CVE-2012-2994Sep 18, 2012
Cososys
Endpoint Protector
risk 0.04cvss —epss 0.06
The CoSoSys Endpoint Protector 4 appliance establishes an EPProot password based entirely on the appliance serial number, which makes it easier for remote attackers to obtain access via a brute-force attack.